* pack.c (pack_pack): pointer modification check before each

  iteration.  [ruby-dev:24445]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@7015 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 8 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index a5c32b194c..83cfb88ce5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Fri Oct  8 09:49:32 2004  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* pack.c (pack_pack): pointer modification check before each
+	  iteration.  [ruby-dev:24445]
+
 Fri Oct  8 01:13:05 2004  Hidetoshi NAGAI  <nagai@ai.kyutech.ac.jp>
 
 	* ext/tk/lib/tk/optiondb.rb: make it more secure
diff --git a/pack.c b/pack.c
index a435e130b2..498c3553fa 100644
--- a/pack.c
+++ b/pack.c
@@ -499,6 +499,9 @@ pack_pack(ary, fmt)
 #define NEXTFROM (items-- > 0 ? RARRAY(ary)->ptr[idx++] : (rb_raise(rb_eArgError, toofew),0))
 
     while (p < pend) {
+	if (RSTRING(fmt)->ptr + RSTRING(fmt)->len != pend) {
+	    rb_raise(rb_eRuntimeError, "format string modified");
+	}
 	type = *p++;		/* get data type */
 #ifdef NATINT_PACK
 	natint = 0;